Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Go-shiori |
|
No data.
No data.
References
| Link | Providers |
|---|---|
| https://github.com/go-shiori/shiori |
|
History
Mon, 10 Aug 2026 12:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase. Deleting an account or demoting it from owner to a regular role has no effect on tokens already issued to that account — a deleted or demoted owner's token continues authenticating with its original owner-level privileges until natural expiry, which can be up to 30 days with 'remember me' enabled. | Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase. |
Mon, 10 Aug 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | shiori: JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotion | shiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotion |
Wed, 05 Aug 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 05 Aug 2026 09:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Go-shiori
Go-shiori shiori |
|
| Vendors & Products |
Go-shiori
Go-shiori shiori |
Wed, 05 Aug 2026 07:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase. Deleting an account or demoting it from owner to a regular role has no effect on tokens already issued to that account — a deleted or demoted owner's token continues authenticating with its original owner-level privileges until natural expiry, which can be up to 30 days with 'remember me' enabled. | |
| Title | shiori: JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotion | |
| Weaknesses | CWE-613 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: TuranSec
Published: 2026-08-05T06:59:06.908Z
Updated: 2026-08-10T11:45:07.279Z
Reserved: 2026-08-05T06:56:15.799Z
Link: CVE-2026-71206
Vulnrichment
Updated: 2026-08-05T13:18:51.028Z
NVD
Status : Received
Published: 2026-08-05T08:16:42.587
Modified: 2026-08-10T12:17:24.367
Link: CVE-2026-71206
Redhat
No data.